|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
01-17-2009, 05:12 PM
|
#1 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 6
OS: winxp
|
Google Redirect problem & computer freezing
I've been having problems for a few weeks and have not been able to resolve them:
-when using google i constantly get redirected to shopping sites or other search engines -popup blocker doesn't always work -my computer will often freeze and i have to restart here's my DDS scan: DDS (Version 1.0) - NTFSx86 Run by JoJo at 15:49:26.67 on Sat 01/17/2009 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.156 [GMT -8:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Command Software\dvpapi.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\lxddcoms.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SYSTEM32\USRmlnkA.exe C:\Program Files\TELUS\TELUS Security service\Freedom.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\TELUS\eProtect Advisor\TEPA.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Lexmark 2500 Series\lxddamon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\SYSTEM32\USRshutA.exe C:\WINDOWS\SYSTEM32\USRmlnkA.exe C:\WINDOWS\system32\Updater.exe C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\JoJo\Desktop\dds.com ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.ca/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie mDefault_Page_URL = hxxp://www.msn.com mDefault_Search_URL = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = iexplore uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - c:\program files\telus\telus security service\pkR.dll BHO: {56071E0D-C61B-11D3-B41C-00E02927A304} - c:\program files\telus\telus security service\FreeBHOR.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\3.1.807.1746\swg.dll TB: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll uRun: [Aim6] uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [Windows Update] "c:\windows\system32\Updater.exe" mRun: [VTTimer] VTTimer.exe mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [USRpdA] c:\windows\system32\usrmlnka.exe runservices \device\3cpipe-USRpdA mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [TELUS Security service] "c:\program files\telus\telus security service\Freedom.exe" mRun: [SunJavaUpdateSched] c:\program files\java\jre1.5.0_06\bin\jusched.exe mRun: [TEPA.exe] "c:\program files\telus\eprotect advisor\TEPA.exe" /AUTORUN mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [lxddmon.exe] "c:\program files\lexmark 2500 series\lxddmon.exe" mRun: [lxddamon] "c:\program files\lexmark 2500 series\lxddamon.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\device~1.lnk - c:\program files\olympus\devicedetector\DevDtct2.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll IE: {C5428486-50A0-4a02-9D20-520B59A9F9B2} - {C9CCBB35-D123-4a31-AFFC-9B2933132116} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll IE: {C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll Trusted Zone: *.adgate.info Trusted Zone: *.adsextend.net Trusted Zone: *.dollarrevenue.com Trusted Zone: *.elitemediagroup.net Trusted Zone: *.errorsafe.com Trusted Zone: *.imagesrvr.com Trusted Zone: *.matcash.com Trusted Zone: *.media-motor.com Trusted Zone: *.media-motor.net Trusted Zone: *.mediatickets.net Trusted Zone: *.mt-download.com Trusted Zone: *.snipernet.biz Trusted Zone: *.systemdoctor.com Trusted Zone: *.winantivirus.com Trusted Zone: *.winfixer.com TCP: NameServer = 85.255.116.30;85.255.112.144 TCP: {40D5110C-4B83-4845-9758-2964ADC06721} = 85.255.116.30;85.255.112.144 SEH: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - c:\progra~1\wifd1f~1\MpShHook.dll ============= SERVICES / DRIVERS =============== R2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service [] R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\ViewpointService.exe" [2008-2-2 24652] S1 vspf;vspf;\??\c:\windows\system32\drivers\vspf5.sys [] S1 vspf_hk;vspf_hk;\??\c:\windows\system32\drivers\vspf_hk5.sys [] S2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\\lxddserv.exe [2008-9-3 99248] S4 WinDefend;Windows Defender Service;"c:\program files\windows defender\MsMpEng.exe" [2006-4-3 14032] =============== Created Last 30 ================ 2009-01-12 17:30 94 a------- c:\windows\wininit.ini 2009-01-04 19:47 410,984 a------- c:\windows\system32\deploytk.dll 2009-01-04 19:47 73,728 a------- c:\windows\system32\javacpl.cpl ==================== Find3M ==================== 2008-12-07 16:48 27,904 a------- c:\windows\system32\drivers\Ndisprot.sys 2008-11-22 08:50 139,264 a------- c:\windows\system32\Updater.exe 2007-11-12 15:58 2,293,712 a------- c:\program files\FLV PlayerFCSetup.exe 2006-09-15 16:45 32,135 ---sh--- c:\program files\common files\Yazzle1281OinUninstaller.exe 2006-09-15 16:40 93,635 a--sh--- c:\program files\common files\Yazzle1264OinUninstaller.exe ============= FINISH: 15:49:42.15 =============== attach.txt and ark.txt are attached in a zip file thanks! |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
01-20-2009, 12:28 PM
|
#2 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,590
OS: XP SP3
|
Re: Google Redirect problem & computer freezing
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ Your hard drive is almost full. Having too little free space on your hard drive can compromise system performance. Quote:
------------------------------------------------------ Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Please post the C:\ComboFix.txt in your next reply for further review. ------------------------------------------------------ |
|
|
|
|
|
01-21-2009, 10:25 PM
|
#3 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 6
OS: winxp
|
Re: Google Redirect problem & computer freezing
thanks for responding!
i know the hard drive is really full...my other external hd filled up so now i need a new one, but haven't gotten around to it yet...anyway here is the scan you wanted ComboFix 09-01-21.02 - JoJo 2009-01-21 21:13:12.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.258 [GMT -8:00] Running from: c:\documents and settings\JoJo\Desktop\ComboFix.exe AV: TELUS Security service Anti-Virus *On-access scanning disabled* (Outdated) FW: TELUS Security service Firewall *disabled* . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf c:\documents and settings\All Users\Application Data\WinAntiVirus Pro 2006 c:\documents and settings\JoJo\Application Data\ShoppingReport c:\documents and settings\JoJo\Application Data\ShoppingReport\cs\Config.xml c:\documents and settings\JoJo\Application Data\ShoppingReport\cs\db\Aliases.dbs c:\documents and settings\JoJo\Application Data\ShoppingReport\cs\db\Sites.dbs c:\documents and settings\JoJo\Application Data\ShoppingReport\cs\dwld\WhiteList.xip c:\documents and settings\JoJo\Application Data\ShoppingReport\cs\report\aggr_storage.xml c:\documents and settings\JoJo\Application Data\ShoppingReport\cs\report\send_storage.xml c:\documents and settings\JoJo\Application Data\ShoppingReport\cs\res2\WhiteList.dbs c:\program files\Common Files\companion wizard c:\program files\Common Files\winantivirus pro 2006 c:\program files\Common Files\Yazzle1264OinUninstaller.exe c:\program files\Common Files\Yazzle1281OinUninstaller.exe c:\program files\deskbar c:\program files\deskbar\inst.bat c:\program files\Mozilla Firefox\components\iamfamous.dll c:\program files\ShoppingReport c:\program files\ShoppingReport\Uninst.exe C:\resycled c:\resycled\boot.com c:\windows\system32\drivers\msqpdxmaxtoexh.sys c:\windows\system32\drivers\msqpdxserv.sys c:\windows\system32\msqpdxosvdnrsr.dll c:\windows\system32\stera.job c:\windows\system32\stera.log c:\windows\system32\Updater.exe c:\windows\ymante~1 c:\windows\ymante~1\?ttrib.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_msqpdxserv.sys -------\Legacy_msqpdxserv.sys -------\Legacy_FOPN -------\Legacy_VSPF -------\Legacy_VSPF_HK -------\Service_vspf -------\Service_vspf_hk ((((((((((((((((((((((((( Files Created from 2008-12-22 to 2009-01-22 ))))))))))))))))))))))))))))))) . 2009-01-20 08:55 . 2009-01-21 11:05 54,156 --ah----- c:\windows\QTFont.qfn 2009-01-20 08:55 . 2009-01-20 08:55 1,409 --a------ c:\windows\QTFont.for 2009-01-17 15:50 . 2009-01-17 15:50 250 --a------ c:\windows\gmer.ini 2009-01-12 17:30 . 2009-01-12 17:30 94 --a------ c:\windows\wininit.ini 2009-01-04 19:47 . 2009-01-04 19:46 410,984 --a------ c:\windows\system32\deploytk.dll 2009-01-04 19:47 . 2009-01-04 19:46 73,728 --a------ c:\windows\system32\javacpl.cpl . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-22 04:49 --------- d-----w c:\documents and settings\JoJo\Application Data\uTorrent 2009-01-22 02:15 --------- d-----w c:\program files\Common Files\PestPatrol 2009-01-21 01:48 --------- d-----w c:\program files\Lx_cats 2009-01-13 01:34 --------- d-----w c:\program files\MSN Games 2009-01-13 01:31 --------- d-----w c:\program files\AoA Audio Extractor 2009-01-05 03:46 --------- d-----w c:\program files\Java 2008-12-17 09:53 --------- d-----w c:\documents and settings\JoJo\Application Data\dvdcss 2008-12-11 04:57 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2008-12-09 22:41 --------- d-----w c:\program files\Trend Micro 2008-12-09 07:44 --------- d-----w c:\program files\CCleaner 2008-12-08 00:48 27,904 ----a-w c:\windows\system32\drivers\Ndisprot.sys 2008-12-06 23:45 --------- d-----w c:\program files\Common Files\ACD Systems 2008-12-06 23:38 --------- d-----w c:\program files\homeview 2007-11-12 23:58 2,293,712 ----a-w c:\program files\FLV PlayerFCSetup.exe 2009-01-20 00:25 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2009-01-20 00:25 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2009-01-20 00:25 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2009-01-20 00:25 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2009-01-20 00:25 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-01 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "USRpdA"="c:\windows\SYSTEM32\USRmlnkA.exe" [2004-08-04 77891] "TELUS Security service"="c:\program files\TELUS\TELUS Security service\Freedom.exe" [2005-05-19 180278] "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975] "TEPA.exe"="c:\program files\TELUS\eProtect Advisor\TEPA.exe" [2007-03-20 2061816] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-06-01 257088] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "lxddmon.exe"="c:\program files\Lexmark 2500 Series\lxddmon.exe" [2007-06-11 291760] "lxddamon"="c:\program files\Lexmark 2500 Series\lxddamon.exe" [2007-04-30 20480] "Cmaudio"="cmicnfg.cpl" [2004-04-23 c:\windows\CMICNFG.CPL] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Device Detector 3.lnk - c:\program files\Olympus\DeviceDetector\DevDtct2.exe [2007-09-23 118784] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.ACDV"= ACDV.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0stera [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Outlook Express\\msimn.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\StubInstaller.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Lexmark 2500 Series\\lxddamon.exe"= "c:\\Program Files\\Lexmark 2500 Series\\app4r.exe"= "c:\\WINDOWS\\system32\\lxddcoms.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddpswx.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddjswx.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddtime.exe"= "c:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "25651:TCP"= 25651:TCP:BitComet 25651 TCP "25651:UDP"= 25651:UDP:BitComet 25651 UDP "135:TCP"= 135:TCP:TCP Port 135 "5000:TCP"= 5000:TCP:TCP Port 5000 "5001:TCP"= 5001:TCP:TCP Port 5001 "5002:TCP"= 5002:TCP:TCP Port 5002 "5003:TCP"= 5003:TCP:TCP Port 5003 "5004:TCP"= 5004:TCP:TCP Port 5004 "5005:TCP"= 5005:TCP:TCP Port 5005 "5006:TCP"= 5006:TCP:TCP Port 5006 "5007:TCP"= 5007:TCP:TCP Port 5007 "5008:TCP"= 5008:TCP:TCP Port 5008 "5009:TCP"= 5009:TCP:TCP Port 5009 "5010:TCP"= 5010:TCP:TCP Port 5010 "5011:TCP"= 5011:TCP:TCP Port 5011 "5012:TCP"= 5012:TCP:TCP Port 5012 "5013:TCP"= 5013:TCP:TCP Port 5013 "5014:TCP"= 5014:TCP:TCP Port 5014 "5015:TCP"= 5015:TCP:TCP Port 5015 "5016:TCP"= 5016:TCP:TCP Port 5016 "5017:TCP"= 5017:TCP:TCP Port 5017 "5018:TCP"= 5018:TCP:TCP Port 5018 "5019:TCP"= 5019:TCP:TCP Port 5019 "5020:TCP"= 5020:TCP:TCP Port 5020 R4 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?] R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-02-02 24652] S4 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxddserv.exe [2008-09-03 99248] S4 WinDefend;Windows Defender Service;c:\program files\Windows Defender\MsMpEng.exe [2006-04-03 14032] --- Other Services/Drivers In Memory --- *Deregistered* - Ndisprot.sys . Contents of the 'Scheduled Tasks' folder 2009-01-18 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-04-03 17:12] . - - - - ORPHANS REMOVED - - - - WebBrowser-{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file) HKCU-Run-Aim6 - (no file) HKLM-Run-VTTimer - VTTimer.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.ca/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie mDefault_Search_URL = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = iexplore uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B2} - {C9CCBB35-D123-4a31-AFFC-9B2933132116} - c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} - c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll Trusted Zone: teganandsara.ca\www Trusted Zone: adgate.info Trusted Zone: adsextend.net Trusted Zone: dollarrevenue.com Trusted Zone: elitemediagroup.net Trusted Zone: errorsafe.com Trusted Zone: imagesrvr.com Trusted Zone: matcash.com Trusted Zone: media-motor.com Trusted Zone: media-motor.net Trusted Zone: mediatickets.net Trusted Zone: mt-download.com Trusted Zone: snipernet.biz Trusted Zone: systemdoctor.com Trusted Zone: winantivirus.com Trusted Zone: winfixer.com FF - ProfilePath - c:\documents and settings\JoJo\Application Data\Mozilla\Firefox\Profiles\6blx1jgr.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/ FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-21 21:17:44 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Command Software\dvpapi.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\lxddcoms.exe c:\windows\system32\wdfmgr.exe c:\windows\system32\usrshuta.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2009-01-21 21:21:40 - machine was rebooted ComboFix-quarantined-files.txt 2009-01-22 05:21:38 Pre-Run: 2,000,166,912 bytes free Post-Run: 2,144,325,632 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 231 --- E O F --- 2007-12-17 07:17:59 |
|
|
|
|
01-22-2009, 06:26 AM
|
#4 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,590
OS: XP SP3
|
Re: Google Redirect problem & computer freezing
Hello jjjoey. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here If you decide to uninstall it, also delete the following Folders if they still exist: C:\Program Files\Viewpoint C:\Documents and Settings\All Users\Application Data\Viewpoint ------------------------------------------------------ I see you have P2P software ( uTorrent ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here, here, and here. I would strongly recommend that you uninstall it, however that choice is up to you. If you choose to remove this program, you can do so via Control Panel >> Add or Remove Programs. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
 Referring to the picture above, drag CFScript onto ComboFix Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Please post the following in your next reply: ComboFix.txt Kaspersky report report on system behavior |
|
|
|
|
|
01-24-2009, 01:15 AM
|
#5 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 6
OS: winxp
|
Re: Google Redirect problem & computer freezing
my computer has been running a lot better since the first combofix scan...google has not redirected anymore, but i'm still having some popups and the computer is a bit slow. I've had to restart once today, but not nearly as much in the last couple days.
here is the new combofix report: ComboFix 09-01-21.02 - JoJo 2009-01-23 20:30:42.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.254 [GMT -8:00] Running from: c:\documents and settings\JoJo\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\JoJo\Desktop\CFScript.txt AV: TELUS Security service Anti-Virus *On-access scanning disabled* (Outdated) FW: TELUS Security service Firewall *disabled* * Created a new restore point FILE :: c:\windows\system32\drivers\Ndisprot.sys c:\windows\wininit.ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\drivers\Ndisprot.sys c:\windows\wininit.ini . ((((((((((((((((((((((((( Files Created from 2008-12-24 to 2009-01-24 ))))))))))))))))))))))))))))))) . 2009-01-23 13:02 . 2009-01-23 13:02 <DIR> d-------- c:\program files\Radialpoint 2009-01-22 23:23 . 2009-01-22 23:23 <DIR> d-------- c:\program files\MSXML 4.0 2009-01-22 23:21 . 2009-01-22 23:30 1,374 --a------ c:\windows\imsins.BAK 2009-01-22 08:05 . 2009-01-22 08:29 <DIR> d-------- c:\windows\system32\CatRoot_bak 2009-01-22 08:04 . 2008-06-13 05:10 272,128 --------- c:\windows\system32\drivers\bthport.sys 2009-01-22 08:04 . 2008-06-13 05:10 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys 2009-01-17 15:50 . 2009-01-17 15:50 250 --a------ c:\windows\gmer.ini 2009-01-04 19:47 . 2009-01-04 19:46 410,984 --a------ c:\windows\system32\deploytk.dll 2009-01-04 19:47 . 2009-01-04 19:46 73,728 --a------ c:\windows\system32\javacpl.cpl . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-24 04:27 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2009-01-24 04:17 --------- d-----w c:\program files\Lx_cats 2009-01-24 03:29 --------- d-----w c:\documents and settings\JoJo\Application Data\uTorrent 2009-01-23 21:02 --------- d-----w c:\program files\Common Files\PestPatrol 2009-01-13 01:34 --------- d-----w c:\program files\MSN Games 2009-01-13 01:31 --------- d-----w c:\program files\AoA Audio Extractor 2009-01-05 03:46 --------- d-----w c:\program files\Java 2008-12-17 09:53 --------- d-----w c:\documents and settings\JoJo\Application Data\dvdcss 2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys 2008-12-11 04:57 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2008-12-09 22:41 --------- d-----w c:\program files\Trend Micro 2008-12-09 07:44 --------- d-----w c:\program files\CCleaner 2008-12-06 23:45 --------- d-----w c:\program files\Common Files\ACD Systems 2008-12-06 23:38 --------- d-----w c:\program files\homeview 2007-11-12 23:58 2,293,712 ----a-w c:\program files\FLV PlayerFCSetup.exe 2009-01-20 00:25 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2009-01-20 00:25 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2009-01-20 00:25 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2009-01-20 00:25 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2009-01-20 00:25 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((( snapshot@2009-01-21_21.20.53.60 ))))))))))))))))))))))))))))))))))))))))) . + 2008-06-13 13:10:50 272,128 ------w c:\windows\Driver Cache\i386\bthport.sys - 2006-05-05 09:41:45 453,120 ----a-w c:\windows\Driver Cache\i386\mrxsmb.sys + 2008-10-24 11:10:42 453,632 ----a-w c:\windows\Driver Cache\i386\mrxsmb.sys - 2007-02-28 09:08:48 2,136,064 ------w c:\windows\Driver Cache\i386\ntkrnlmp.exe + 2008-08-14 09:58:27 2,136,064 ------w c:\windows\Driver Cache\i386\ntkrnlmp.exe - 2007-02-28 08:38:55 2,057,600 ------w c:\windows\Driver Cache\i386\ntkrnlpa.exe + 2008-08-14 09:22:13 2,057,728 ------w c:\windows\Driver Cache\i386\ntkrnlpa.exe - 2007-02-28 08:38:57 2,015,744 ------w c:\windows\Driver Cache\i386\ntkrpamp.exe + 2008-08-14 09:22:14 2,015,744 ------w c:\windows\Driver Cache\i386\ntkrpamp.exe - 2007-02-28 09:10:57 2,180,352 ------w c:\windows\Driver Cache\i386\ntoskrnl.exe + 2008-08-14 10:00:45 2,180,352 ------w c:\windows\Driver Cache\i386\ntoskrnl.exe + 2009-01-23 21:02:12 53,248 ----a-r c:\windows\Installer\{53BEA20C-4566-401D-8C02-EDEC5678218B}\ARPPRODUCTICON.exe + 2009-01-23 07:23:10 32,768 ----a-r c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe - 2007-10-11 06:13:44 1,023,488 ----a-w c:\windows\system32\browseui.dll + 2008-10-16 10:37:04 1,023,488 ----a-w c:\windows\system32\browseui.dll - 2007-10-11 06:13:44 151,040 ----a-w c:\windows\system32\cdfview.dll + 2008-10-16 10:37:02 151,040 ----a-w c:\windows\system32\cdfview.dll - 2007-10-11 06:13:44 1,054,208 ----a-w c:\windows\system32\danim.dll + 2008-10-16 10:37:02 1,054,208 ----a-w c:\windows\system32\danim.dll - 2004-08-04 12:00:00 138,496 -c--a-w c:\windows\system32\dllcache\afd.sys + 2008-08-14 09:51:43 138,368 -c----w c:\windows\system32\dllcache\afd.sys - 2007-10-11 06:13:44 1,023,488 -c--a-w c:\windows\system32\dllcache\browseui.dll + 2008-10-16 10:37:04 1,023,488 -c--a-w c:\windows\system32\dllcache\browseui.dll - 2007-10-11 06:13:44 151,040 -c--a-w c:\windows\system32\dllcache\cdfview.dll + 2008-10-16 10:37:02 151,040 -c--a-w c:\windows\system32\dllcache\cdfview.dll - 2007-10-11 06:13:44 1,054,208 -c--a-w c:\windows\system32\dllcache\danim.dll + 2008-10-16 10:37:02 1,054,208 -c--a-w c:\windows\system32\dllcache\danim.dll - 2006-06-26 17:37:10 148,480 -c--a-w c:\windows\system32\dllcache\dnsapi.dll + 2008-06-20 17:41:10 148,992 -c--a-w c:\windows\system32\dllcache\dnsapi.dll - 2007-10-11 06:13:44 357,888 -c--a-w c:\windows\system32\dllcache\dxtmsft.dll + 2008-10-16 10:37:02 357,888 -c--a-w c:\windows\system32\dllcache\dxtmsft.dll - 2007-10-11 06:13:44 205,312 -c--a-w c:\windows\system32\dllcache\dxtrans.dll + 2008-10-16 10:37:02 205,312 -c--a-w c:\windows\system32\dllcache\dxtrans.dll - 2005-07-26 04:39:45 243,200 -c--a-w c:\windows\system32\dllcache\es.dll + 2008-07-07 20:32:22 253,952 -c--a-w c:\windows\system32\dllcache\es.dll - 2007-10-11 06:13:44 55,808 -c--a-w c:\windows\system32\dllcache\extmgr.dll + 2008-10-16 10:37:02 55,808 -c--a-w c:\windows\system32\dllcache\extmgr.dll - 2007-06-19 13:31:19 282,112 -c--a-w c:\windows\system32\dllcache\gdi32.dll + 2008-10-23 13:01:36 283,648 -c--a-w c:\windows\system32\dllcache\gdi32.dll - 2007-10-10 11:16:27 18,432 -c--a-w c:\windows\system32\dllcache\iedw.exe + 2008-10-15 09:45:01 18,432 -c--a-w c:\windows\system32\dllcache\iedw.exe - 2007-10-11 06:13:44 251,392 -c--a-w c:\windows\system32\dllcache\iepeers.dll + 2008-10-16 10:37:02 251,392 -c--a-w c:\windows\system32\dllcache\iepeers.dll - 2007-08-21 06:15:44 683,520 -c--a-w c:\windows\system32\dllcache\inetcomm.dll + 2008-04-11 18:50:43 683,520 -c--a-w c:\windows\system32\dllcache\inetcomm.dll - 2007-10-11 06:13:44 96,256 -c--a-w c:\windows\system32\dllcache\inseng.dll + 2008-10-16 10:37:02 96,256 -c--a-w c:\windows\system32\dllcache\inseng.dll - 2007-11-14 07:26:56 450,560 -c--a-w c:\windows\system32\dllcache\jscript.dll + 2007-12-18 14:40:58 450,560 -c--a-w c:\windows\system32\dllcache\jscript.dll - 2007-10-11 06:13:44 16,384 -c--a-w c:\windows\system32\dllcache\jsproxy.dll + 2008-10-16 10:37:03 16,384 -c--a-w c:\windows\system32\dllcache\jsproxy.dll - 2004-08-11 08:45:04 96,768 -c--a-w c:\windows\system32\dllcache\logagent.exe + 2008-06-10 17:17:42 96,768 -c--a-w c:\windows\system32\dllcache\logagent.exe - 2006-05-05 09:41:45 453,120 -c----w c:\windows\system32\dllcache\mrxsmb.sys + 2008-10-24 11:10:42 453,632 -c----w c:\windows\system32\dllcache\mrxsmb.sys - 2004-08-04 12:00:00 331,776 -c--a-w c:\windows\system32\dllcache\msadce.dll + 2008-05-01 14:30:33 331,776 -c--a-w c:\windows\system32\dllcache\msadce.dll - 2005-06-29 01:46:00 74,240 -c--a-w c:\windows\system32\dllcache\mscms.dll + 2008-06-24 16:23:05 74,240 -c--a-w c:\windows\system32\dllcache\mscms.dll - 2007-10-30 10:16:33 3,058,688 -c--a-w c:\windows\system32\dllcache\mshtml.dll + 2008-12-12 17:33:23 3,060,224 -c--a-w c:\windows\system32\dllcache\mshtml.dll - 2007-10-11 06:13:45 449,024 -c--a-w c:\windows\system32\dllcache\mshtmled.dll + 2008-10-16 10:37:03 449,024 -c--a-w c:\windows\system32\dllcache\mshtmled.dll - 2007-10-11 06:13:45 146,432 -c--a-w c:\windows\system32\dllcache\msrating.dll + 2008-10-16 10:37:02 146,432 -c--a-w c:\windows\system32\dllcache\msrating.dll - 2007-10-11 06:13:45 532,480 -c--a-w c:\windows\system32\dllcache\mstime.dll + 2008-10-16 10:37:02 532,480 -c--a-w c:\windows\system32\dllcache\mstime.dll - 2004-08-04 12:00:00 245,248 -c--a-w c:\windows\system32\dllcache\mswsock.dll + 2008-06-20 17:41:10 245,248 -c--a-w c:\windows\system32\dllcache\mswsock.dll - 2007-06-26 06:08:16 1,104,896 -c--a-w c:\windows\system32\dllcache\msxml3.dll + 2008-09-04 16:42:02 1,106,944 -c--a-w c:\windows\system32\dllcache\msxml3.dll - 2006-08-17 12:28:27 332,288 -c--a-w c:\windows\system32\dllcache\netapi32.dll + 2008-10-15 16:57:55 332,800 -c--a-w c:\windows\system32\dllcache\netapi32.dll - 2007-02-28 09:08:48 2,136,064 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe + 2008-08-14 09:58:27 2,136,064 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe - 2007-02-28 08:38:55 2,057,600 -c----w c:\windows\system32\dllcache\ntkrnlpa.exe + 2008-08-14 09:22:13 2,057,728 -c----w c:\windows\system32\dllcache\ntkrnlpa.exe - 2007-02-28 08:38:57 2,015,744 -c----w c:\windows\system32\dllcache\ntkrpamp.exe + 2008-08-14 09:22:14 2,015,744 -c----w c:\windows\system32\dllcache\ntkrpamp.exe - 2007-02-28 09:10:57 2,180,352 -c----w c:\windows\system32\dllcache\ntoskrnl.exe + 2008-08-14 10:00:45 2,180,352 -c----w c:\windows\system32\dllcache\ntoskrnl.exe - 2007-10-11 06:13:45 39,424 -c--a-w c:\windows\system32\dllcache\pngfilt.dll + 2008-10-16 10:37:02 39,424 -c--a-w c:\windows\system32\dllcache\pngfilt.dll - 2007-10-29 22:43:03 1,287,680 -c--a-w c:\windows\system32\dllcache\quartz.dll + 2008-05-07 05:18:48 1,287,680 -c--a-w c:\windows\system32\dllcache\quartz.dll - 2006-07-13 08:48:58 202,240 -c--a-w c:\windows\system32\dllcache\rmcast.sys + 2008-05-08 12:28:49 202,752 -c--a-w c:\windows\system32\dllcache\rmcast.sys - 2007-10-11 06:13:45 1,494,528 -c--a-w c:\windows\system32\dllcache\shdocvw.dll + 2008-10-16 10:37:03 1,494,528 -c--a-w c:\windows\system32\dllcache\shdocvw.dll - 2007-10-11 06:13:45 474,112 -c--a-w c:\windows\system32\dllcache\shlwapi.dll + 2008-10-16 10:37:03 474,112 -c--a-w c:\windows\system32\dllcache\shlwapi.dll - 2006-08-14 10:34:41 332,928 -c--a-w c:\windows\system32\dllcache\srv.sys + 2008-12-11 11:57:21 333,184 -c--a-w c:\windows\system32\dllcache\srv.sys - 2006-08-21 17:52:08 246,814 -c--a-w c:\windows\system32\dllcache\strmdll.dll + 2008-10-03 10:15:47 247,326 -c--a-w c:\windows\system32\dllcache\strmdll.dll - 2006-04-20 11:51:50 359,808 -c--a-w c:\windows\system32\dllcache\tcpip.sys + 2008-06-20 10:45:13 360,320 -c--a-w c:\windows\system32\dllcache\tcpip.sys - 2006-08-16 09:37:30 225,664 -c--a-w c:\windows\system32\dllcache\tcpip6.sys + 2008-06-20 09:52:06 225,920 -c--a-w c:\windows\system32\dllcache\tcpip6.sys - 2007-10-11 06:13:45 615,424 -c--a-w c:\windows\system32\dllcache\urlmon.dll + 2008-10-16 10:37:04 615,936 -c--a-w c:\windows\system32\dllcache\urlmon.dll - 2004-08-04 12:00:00 417,792 -c--a-w c:\windows\system32\dllcache\vbscript.dll + 2007-12-18 14:40:58 417,792 -c--a-w c:\windows\system32\dllcache\vbscript.dll - 2007-03-08 13:47:48 1,843,584 -c--a-w c:\windows\system32\dllcache\win32k.sys + 2008-09-15 11:57:41 1,846,016 -c--a-w c:\windows\system32\dllcache\win32k.sys - 2007-10-11 06:13:45 659,456 -c--a-w c:\windows\system32\dllcache\wininet.dll + 2008-10-16 10:37:03 659,456 -c--a-w c:\windows\system32\dllcache\wininet.dll - 2004-08-11 08:45:04 1,027,072 -c--a-w c:\windows\system32\dllcache\wmnetmgr.dll + 2008-06-10 19:37:02 1,026,048 -c--a-w c:\windows\system32\dllcache\WMNetmgr.dll - 2006-12-07 06:40:49 2,362,184 -c--a-w c:\windows\system32\dllcache\wmvcore.dll + 2008-06-10 19:57:40 2,364,472 -c--a-w c:\windows\system32\dllcache\WMVCore.dll - 2006-06-26 17:37:10 148,480 ----a-w c:\windows\system32\dnsapi.dll + 2008-06-20 17:41:10 148,992 ----a-w c:\windows\system32\dnsapi.dll - 2004-08-04 12:00:00 138,496 ----a-w c:\windows\system32\drivers\afd.sys + 2008-08-14 09:51:43 138,368 ----a-w c:\windows\system32\drivers\afd.sys - 2006-05-05 09:41:45 453,120 ----a-w c:\windows\system32\drivers\mrxsmb.sys + 2008-10-24 11:10:42 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys - 2006-07-13 08:48:58 202,240 ----a-w c:\windows\system32\drivers\rmcast.sys + 2008-05-08 12:28:49 202,752 ----a-w c:\windows\system32\drivers\rmcast.sys - 2006-04-20 11:51:50 359,808 ----a-w c:\windows\system32\drivers\tcpip.sys + 2008-06-20 10:45:13 360,320 ----a-w c:\windows\system32\drivers\tcpip.sys - 2006-08-16 09:37:30 225,664 ----a-w c:\windows\system32\drivers\tcpip6.sys + 2008-06-20 09:52:06 225,920 ----a-w c:\windows\system32\drivers\tcpip6.sys - 2007-10-11 06:13:44 357,888 ----a-w c:\windows\system32\dxtmsft.dll + 2008-10-16 10:37:02 357,888 ----a-w c:\windows\system32\dxtmsft.dll - 2007-10-11 06:13:44 205,312 ----a-w c:\windows\system32\dxtrans.dll + 2008-10-16 10:37:02 205,312 ----a-w c:\windows\system32\dxtrans.dll - 2005-07-26 04:39:45 243,200 ----a-w c:\windows\system32\es.dll + 2008-07-07 20:32:22 253,952 ----a-w c:\windows\system32\es.dll - 2007-10-11 06:13:44 55,808 ----a-w c:\windows\system32\extmgr.dll + 2008-10-16 10:37:02 55,808 ----a-w c:\windows\system32\extmgr.dll - 2008-01-23 19:02:29 173,080 ----a-w c:\windows\system32\FNTCACHE.DAT + 2009-01-23 08:22:17 173,080 ----a-w c:\windows\system32\FNTCACHE.DAT - 2007-06-19 13:31:19 282,112 ----a-w c:\windows\system32\gdi32.dll + 2008-10-23 13:01:36 283,648 ----a-w c:\windows\system32\gdi32.dll - 2007-10-11 06:13:44 251,392 ----a-w c:\windows\system32\iepeers.dll + 2008-10-16 10:37:02 251,392 ----a-w c:\windows\system32\iepeers.dll - 2007-08-21 06:15:44 683,520 ----a-w c:\windows\system32\inetcomm.dll + 2008-04-11 18:50:43 683,520 ----a-w c:\windows\system32\inetcomm.dll - 2007-10-11 06:13:44 96,256 ----a-w c:\windows\system32\inseng.dll + 2008-10-16 10:37:02 96,256 ----a-w c:\windows\system32\inseng.dll - 2007-11-14 07:26:56 450,560 ----a-w c:\windows\system32\jscript.dll + 2007-12-18 14:40:58 450,560 ----a-w c:\windows\system32\jscript.dll - 2007-10-11 06:13:44 16,384 ----a-w c:\windows\system32\jsproxy.dll + 2008-10-16 10:37:03 16,384 ----a-w c:\windows\system32\jsproxy.dll - 2004-08-11 08:45:04 96,768 ----a-w c:\windows\system32\logagent.exe + 2008-06-10 17:17:42 96,768 ----a-w c:\windows\system32\logagent.exe - 2007-12-02 23:00:06 18,684,536 ----a-w c:\windows\system32\MRT.exe + 2009-01-10 01:35:30 20,853,704 ----a-w c:\windows\system32\MRT.exe - 2005-06-29 01:46:00 74,240 ----a-w c:\windows\system32\mscms.dll + 2008-06-24 16:23:05 74,240 ----a-w c:\windows\system32\mscms.dll - 2007-10-30 10:16:33 3,058,688 ----a-w c:\windows\system32\mshtml.dll + 2008-12-12 17:33:23 3,060,224 ----a-w c:\windows\system32\mshtml.dll - 2007-10-11 06:13:45 449,024 ----a-w c:\windows\system32\mshtmled.dll + 2008-10-16 10:37:03 449,024 ----a-w c:\windows\system32\mshtmled.dll - 2007-10-11 06:13:45 146,432 ----a-w c:\windows\system32\msrating.dll + 2008-10-16 10:37:02 146,432 ----a-w c:\windows\system32\msrating.dll - 2007-10-11 06:13:45 532,480 ----a-w c:\windows\system32\mstime.dll + 2008-10-16 10:37:02 532,480 ----a-w c:\windows\system32\mstime.dll - 2004-08-04 12:00:00 245,248 ----a-w c:\windows\system32\mswsock.dll + 2008-06-20 17:41:10 245,248 ----a-w c:\windows\system32\mswsock.dll - 2007-06-26 06:08:16 1,104,896 ----a-w c:\windows\system32\msxml3.dll + 2008-09-04 16:42:02 1,106,944 ----a-w c:\windows\system32\msxml3.dll - 2007-05-08 22:03:04 1,275,392 ----a-w c:\windows\system32\msxml4.dll + 2008-10-01 00:43:34 1,286,152 ----a-w c:\windows\system32\msxml4.dll - 2006-08-17 12:28:27 332,288 ----a-w c:\windows\system32\netapi32.dll + 2008-10-15 16:57:55 332,800 ----a-w c:\windows\system32\netapi32.dll - 2007-02-28 08:38:55 2,057,600 ----a-w c:\windows\system32\ntkrnlpa.exe + 2008-08-14 09:22:13 2,057,728 ----a-w c:\windows\system32\ntkrnlpa.exe - 2007-02-28 09:10:57 2,180,352 ----a-w c:\windows\system32\ntoskrnl.exe + 2008-08-14 10:00:45 2,180,352 ----a-w c:\windows\system32\ntoskrnl.exe - 2007-10-11 06:13:45 39,424 ----a-w c:\windows\system32\pngfilt.dll + 2008-10-16 10:37:02 39,424 ----a-w c:\windows\system32\pngfilt.dll - 2007-10-29 22:43:03 1,287,680 ----a-w c:\windows\system32\quartz.dll + 2008-05-07 05:18:48 1,287,680 ----a-w c:\windows\system32\quartz.dll - 2007-10-11 06:13:45 1,494,528 ----a-w c:\windows\system32\shdocvw.dll + 2008-10-16 10:37:03 1,494,528 ----a-w c:\windows\system32\shdocvw.dll - 2007-10-11 06:13:45 474,112 ----a-w c:\windows\system32\shlwapi.dll + 2008-10-16 10:37:03 474,112 ----a-w c:\windows\system32\shlwapi.dll - 2007-03-06 01:22:33 14,048 ------w c:\windows\system32\spmsg.dll + 2007-11-30 11:18:51 17,272 ------w c:\windows\system32\spmsg.dll - 2006-08-21 17:52:08 246,814 ----a-w c:\windows\system32\strmdll.dll + 2008-10-03 10:15:47 247,326 ----a-w c:\windows\system32\strmdll.dll - 2007-11-13 11:31:11 60,416 ------w c:\windows\system32\tzchange.exe + 2008-10-22 09:47:07 62,976 ------w c:\windows\system32\tzchange.exe - 2007-10-11 06:13:45 615,424 ----a-w c:\windows\system32\urlmon.dll + 2008-10-16 10:37:04 615,936 ----a-w c:\windows\system32\urlmon.dll - 2004-08-04 12:00:00 417,792 ----a-w c:\windows\system32\vbscript.dll + 2007-12-18 14:40:58 417,792 ----a-w c:\windows\system32\vbscript.dll - 2007-03-08 13:47:48 1,843,584 ----a-w c:\windows\system32\win32k.sys + 2008-09-15 11:57:41 1,846,016 ----a-w c:\windows\system32\win32k.sys - 2007-10-11 06:13:45 659,456 ----a-w c:\windows\system32\wininet.dll + 2008-10-16 10:37:03 659,456 ----a-w c:\windows\system32\wininet.dll - 2004-08-11 08:45:04 1,027,072 ----a-w c:\windows\system32\wmnetmgr.dll + 2008-06-10 19:37:02 1,026,048 ----a-w c:\windows\system32\WMNetmgr.dll - 2006-12-07 06:40:49 2,362,184 ----a-w c:\windows\system32\wmvcore.dll + 2008-06-10 19:57:40 2,364,472 ----a-w c:\windows\system32\WMVCore.dll - 2007-10-29 10:26:53 115,712 ----a-w c:\windows\system32\xpsp3res.dll + 2008-10-15 14:00:41 351,744 ----a-w c:\windows\system32\xpsp3res.dll + 2009-01-23 17:57:25 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_778.dat + 2008-10-01 00:42:08 1,286,152 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll + 2008-10-01 00:45:12 91,656 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll + 2008-04-15 17:54:19 1,724,416 ----a-w c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-01 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "USRpdA"="c:\windows\SYSTEM32\USRmlnkA.exe" [2004-08-04 77891] "TELUS Security service"="c:\program files\TELUS\TELUS Security service\Freedom.exe" [2005-05-19 180278] "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975] "TEPA.exe"="c:\program files\TELUS\eProtect Advisor\TEPA.exe" [2007-03-20 2061816] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-06-01 257088] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "lxddmon.exe"="c:\program files\Lexmark 2500 Series\lxddmon.exe" [2007-06-11 291760] "lxddamon"="c:\program files\Lexmark 2500 Series\lxddamon.exe" [2007-04-30 20480] "Cmaudio"="cmicnfg.cpl" [2004-04-23 c:\windows\CMICNFG.CPL] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Device Detector 3.lnk - c:\program files\Olympus\DeviceDetector\DevDtct2.exe [2007-09-23 118784] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.ACDV"= ACDV.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0stera [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Outlook Express\\msimn.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\StubInstaller.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Lexmark 2500 Series\\lxddamon.exe"= "c:\\Program Files\\Lexmark 2500 Series\\app4r.exe"= "c:\\WINDOWS\\system32\\lxddcoms.exe"= "c:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddpswx.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddjswx.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddtime.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "135:TCP"= 135:TCP:TCP Port 135 "5000:TCP"= 5000:TCP:TCP Port 5000 "5001:TCP"= 5001:TCP:TCP Port 5001 "5002:TCP"= 5002:TCP:TCP Port 5002 "5003:TCP"= 5003:TCP:TCP Port 5003 "5004:TCP"= 5004:TCP:TCP Port 5004 "5005:TCP"= 5005:TCP:TCP Port 5005 "5006:TCP"= 5006:TCP:TCP Port 5006 "5007:TCP"= 5007:TCP:TCP Port 5007 "5008:TCP"= 5008:TCP:TCP Port 5008 "5009:TCP"= 5009:TCP:TCP Port 5009 "5010:TCP"= 5010:TCP:TCP Port 5010 "5011:TCP"= 5011:TCP:TCP Port 5011 "5012:TCP"= 5012:TCP:TCP Port 5012 "5013:TCP"= 5013:TCP:TCP Port 5013 "5014:TCP"= 5014:TCP:TCP Port 5014 "5015:TCP"= 5015:TCP:TCP Port 5015 "5016:TCP"= 5016:TCP:TCP Port 5016 "5017:TCP"= 5017:TCP:TCP Port 5017 "5018:TCP"= 5018:TCP:TCP Port 5018 "5019:TCP"= 5019:TCP:TCP Port 5019 "5020:TCP"= 5020:TCP:TCP Port 5020 R4 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?] S4 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxddserv.exe [2008-09-03 99248] S4 WinDefend;Windows Defender Service;c:\program files\Windows Defender\MsMpEng.exe [2006-04-03 14032] --- Other Services/Drivers In Memory --- *Deregistered* - Ndisprot.sys . Contents of the 'Scheduled Tasks' folder 2009-01-18 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-04-03 17:12] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.ca/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} - Trusted Zone: teganandsara.ca\www Trusted Zone: adgate.info Trusted Zone: adsextend.net Trusted Zone: dollarrevenue.com Trusted Zone: elitemediagroup.net Trusted Zone: errorsafe.com Trusted Zone: imagesrvr.com Trusted Zone: matcash.com Trusted Zone: media-motor.com Trusted Zone: media-motor.net Trusted Zone: mediatickets.net Trusted Zone: mt-download.com Trusted Zone: snipernet.biz Trusted Zone: systemdoctor.com Trusted Zone: winantivirus.com Trusted Zone: winfixer.com FF - ProfilePath - c:\documents and settings\JoJo\Application Data\Mozilla\Firefox\Profiles\6blx1jgr.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/ FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-23 20:34:19 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2009-01-23 20:36:26 ComboFix-quarantined-files.txt 2009-01-24 04:36:09 ComboFix2.txt 2009-01-22 05:21:42 Pre-Run: 4,541,509,632 bytes free Post-Run: 4,661,985,280 bytes free 380 --- E O F --- 2009-01-23 07:30:25 and here is the kaspersky report: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Saturday, January 24, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, January 24, 2009 03:27:43 Records in database: 1690407 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan statistics: Files scanned: 59378 Threat name: 9 Infected objects: 13 Suspicious objects: 0 Duration of the scan: 01:51:42 File name / Threat name / Threats count C:\Documents and Settings\All Users\Documents\My Music\mp3s\atomic girl wannabes 43.wma Infected: Trojan-Downloader.WMA.Wimad.d 1 C:\Documents and Settings\All Users\Documents\My Music\mp3s\aud lang syne.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1 C:\Documents and Settings\All Users\Documents\My Music\mp3s\Auld lang Syne (Munich Soundorchester).mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1 C:\Documents and Settings\All Users\Documents\My Music\mp3s\avucchella - greatest hits.wma Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\All Users\Documents\My Music\mp3s\avucchella.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1 C:\Documents and Settings\All Users\Documents\My Music\mp3s\donde esta santa claus.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1 C:\Qoobox\Quarantine\C\Program Files\Mozilla Firefox\components\iamfamous.dll.vir Infected: Trojan.Win32.Agent.avjo 1 C:\Qoobox\Quarantine\C\resycled\boot.com.vir Infected: Packed.Win32.Krap.d 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\msqpdxosvdnrsr.dll.vir Infected: Packed.Win32.Krap.d 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\Updater.exe.vir Infected: Backdoor.Win32.MoSucker.20.d 1 C:\Qoobox\Quarantine\C\WINDOWS\YMANTE~1\аttrib.exe.vir Infected: not-a-virus:AdWare.Win32.PurityScan.eu 1 C:\WINDOWS\system32\guard.tmp Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1 C:\WINDOWS\system32\sjv.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak 1 The selected area was scanned. |
|
|
|
|
01-24-2009, 06:20 AM
|
#6 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,590
OS: XP SP3
|
Re: Google Redirect problem & computer freezing
Hello again, jjjoey. Let me know if you still get popups after doing the following:
Open Notepad and copy/paste the entire contents of the codebox below into Notepad: Code:
@echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( "C:\Documents and Settings\All Users\Documents\My Music\mp3s\atomic girl wannabes 43.wma" "C:\Documents and Settings\All Users\Documents\My Music\mp3s\aud lang syne.mp3" "C:\Documents and Settings\All Users\Documents\My Music\mp3s\Auld lang Syne (Munich Soundorchester).mp3" "C:\Documents and Settings\All Users\Documents\My Music\mp3s\avucchella - greatest hits.wma" "C:\Documents and Settings\All Users\Documents\My Music\mp3s\avucchella.mp3" "C:\Documents and Settings\All Users\Documents\My Music\mp3s\donde esta santa claus.mp3" "C:\WINDOWS\system32\guard.tmp" "C:\WINDOWS\system32\sjv.dll" ) do ( del /a/f/q %%g >nul 2>&1 if exist %%g echo.%%~g>>"%temp%\log.txt" ) if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt" ) else echo.Deleted Successfully !! pause del %0 It should look like this:  Double-click on fix.bat to run it. Tell me what it says in your next reply. Press any key to continue. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. Please close HijackThis now. ----------------------------------------------------- |
|
|
|
|
01-24-2009, 01:10 PM
|
#7 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 6
OS: winxp
|
Re: Google Redirect problem & computer freezing
ok i haven't had any popups now
thank you! here is hijack this log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12  58 PM, on 1/24/2009Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Command Software\dvpapi.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\lxddcoms.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\SYSTEM32\USRmlnkA.exe C:\Program Files\TELUS\TELUS Security service\Freedom.exe C:\Program Files\TELUS\eProtect Advisor\TEPA.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\SYSTEM32\USRshutA.exe C:\WINDOWS\SYSTEM32\USRmlnkA.exe C:\Program Files\Lexmark 2500 Series\lxddamon.exe C:\Program Files\Java\bin\jusched.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: PopKill Class - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\TELUS\TELUS Security service\pkR.dll O2 - BHO: ZKBho Class - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\TELUS\TELUS Security service\FreeBHOR.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA O4 - HKLM\..\Run: [TELUS Security service] "C:\Program Files\TELUS\TELUS Security service\Freedom.exe" O4 - HKLM\..\Run: [TEPA.exe] "C:\Program Files\TELUS\eProtect Advisor\TEPA.exe" /AUTORUN O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe" O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\bin\jusched.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O15 - Trusted Zone: *.adgate.info (HKLM) O15 - Trusted Zone: *.adsextend.net (HKLM) O15 - Trusted Zone: *.dollarrevenue.com (HKLM) O15 - Trusted Zone: *.elitemediagroup.net (HKLM) O15 - Trusted Zone: *.errorsafe.com (HKLM) O15 - Trusted Zone: *.imagesrvr.com (HKLM) O15 - Trusted Zone: *.matcash.com (HKLM) O15 - Trusted Zone: *.media-motor.com (HKLM) O15 - Trusted Zone: *.media-motor.net (HKLM) O15 - Trusted Zone: *.mediatickets.net (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.snipernet.biz (HKLM) O15 - Trusted Zone: *.systemdoctor.com (HKLM) O15 - Trusted Zone: *.winantivirus.com (HKLM) O15 - Trusted Zone: *.winfixer.com (HKLM) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204 O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} (MALPlaybackCtrl Class) - http://musicstore.connect.com/XSL/mb...LStreaming.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe -- End of file - 7182 bytes |
|
|
|
|
01-24-2009, 01:25 PM
|
#8 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,590
OS: XP SP3
|
Re: Google Redirect problem & computer freezing
Hello again, jjjoey.
Open Notepad and copy/paste the entire contents of the codebox below into Notepad (don't forget to copy and paste REGEDIT4): Code:
REGEDIT4 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] "BootExecute"=hex(7):61,75,74,6f,63,68,65,63,6b,20,61,75,74,6f,63,68,6b,20,2a,00,00 It should look like this:  Double-click on fix.reg and choose Yes to merge/add it to the registry. Please delete the file afterwards. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they still exist: (Make sure you do not miss any) O15 - Trusted Zone: *.adgate.info (HKLM) O15 - Trusted Zone: *.adsextend.net (HKLM) O15 - Trusted Zone: *.dollarrevenue.com (HKLM) O15 - Trusted Zone: *.elitemediagroup.net (HKLM) O15 - Trusted Zone: *.errorsafe.com (HKLM) O15 - Trusted Zone: *.imagesrvr.com (HKLM) O15 - Trusted Zone: *.matcash.com (HKLM) O15 - Trusted Zone: *.media-motor.com (HKLM) O15 - Trusted Zone: *.media-motor.net (HKLM) O15 - Trusted Zone: *.mediatickets.net (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.snipernet.biz (HKLM) O15 - Trusted Zone: *.systemdoctor.com (HKLM) O15 - Trusted Zone: *.winantivirus.com (HKLM) O15 - Trusted Zone: *.winfixer.com (HKLM) Please remember to close all other windows, including browsers then click Fix checked. Click 'Scan' and then click 'Save log'. Please post the new HijackThis log in your next reply. Please close HijackThis now. ------------------------------------------------------ Last edited by chemist; 01-24-2009 at 01:57 PM. |
|
|
|
|
01-24-2009, 03:33 PM
|
#9 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 6
OS: winxp
|
Re: Google Redirect problem & computer freezing
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:33:19 PM, on 1/24/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Command Software\dvpapi.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\lxddcoms.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\SYSTEM32\USRmlnkA.exe C:\Program Files\TELUS\TELUS Security service\Freedom.exe C:\Program Files\TELUS\eProtect Advisor\TEPA.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\SYSTEM32\USRshutA.exe C:\WINDOWS\SYSTEM32\USRmlnkA.exe C:\Program Files\Lexmark 2500 Series\lxddamon.exe C:\Program Files\Java\bin\jusched.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: PopKill Class - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\TELUS\TELUS Security service\pkR.dll O2 - BHO: ZKBho Class - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\TELUS\TELUS Security service\FreeBHOR.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA O4 - HKLM\..\Run: [TELUS Security service] "C:\Program Files\TELUS\TELUS Security service\Freedom.exe" O4 - HKLM\..\Run: [TEPA.exe] "C:\Program Files\TELUS\eProtect Advisor\TEPA.exe" /AUTORUN O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe" O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\bin\jusched.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204 O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} (MALPlaybackCtrl Class) - http://musicstore.connect.com/XSL/mb...LStreaming.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe -- End of file - 6468 bytes |
|
|
|
|
01-24-2009, 03:39 PM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,590
OS: XP SP3
|
Re: Google Redirect problem & computer freezing
Congratulations. Well done! Your logs appear clean. You should be good to go.
As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
